diff options
| author | Alexander Morozov <lk4d4math@gmail.com> | 2016-05-27 15:02:31 -0700 |
|---|---|---|
| committer | Ian Lance Taylor <iant@golang.org> | 2016-06-02 17:21:34 +0000 |
| commit | 853cd1f4a61396cccb91522ed59af52d61aa8371 (patch) | |
| tree | 6861440f3eab595ddb66791c84670873b4801d80 /src/syscall/exec_linux.go | |
| parent | e90a49a0f5380c6f68502b1febfb73f696c2f610 (diff) | |
| download | go-853cd1f4a61396cccb91522ed59af52d61aa8371.tar.xz | |
syscall: call setgroups for no groups on GNU/Linux
Skip setgroups only for one particular case: GidMappings != nil and
GidMappingsEnableSetgroup == false and list of supplementary groups is
empty.
This patch returns pre-1.5 behavior for simple exec and still allows to
use GidMappings with non-empty Credential.
Change-Id: Ia91c77e76ec5efab7a7f78134ffb529910108fc1
Reviewed-on: https://go-review.googlesource.com/23524
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Diffstat (limited to 'src/syscall/exec_linux.go')
| -rw-r--r-- | src/syscall/exec_linux.go | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/src/syscall/exec_linux.go b/src/syscall/exec_linux.go index 4b8199a2e5..39764f7076 100644 --- a/src/syscall/exec_linux.go +++ b/src/syscall/exec_linux.go @@ -206,9 +206,15 @@ func forkAndExecInChild(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr // User and groups if cred := sys.Credential; cred != nil { ngroups := uintptr(len(cred.Groups)) + groups := uintptr(0) if ngroups > 0 { - groups := unsafe.Pointer(&cred.Groups[0]) - _, _, err1 = RawSyscall(SYS_SETGROUPS, ngroups, uintptr(groups), 0) + groups = uintptr(unsafe.Pointer(&cred.Groups[0])) + } + // Don't call setgroups in case of user namespace, gid mappings + // and disabled setgroups, because otherwise unprivileged user namespace + // will fail with any non-empty SysProcAttr.Credential. + if !(sys.GidMappings != nil && !sys.GidMappingsEnableSetgroups && ngroups == 0) { + _, _, err1 = RawSyscall(SYS_SETGROUPS, ngroups, groups, 0) if err1 != 0 { goto childerror } |